Cruce Consulting LLC ("Cruce," "we," "us," or "our") is an artificial intelligence consulting firm organized under the laws of the State of California, United States. We design, develop, and operate AI-powered software products and services for our clients, including conversational agents, appointment scheduling systems, data processing platforms, and business automation tools. Our principal website is cruceconsulting.com.
This policy describes how we collect, use, disclose, store, and protect personal information when you interact with our products, services, and websites. It covers personal information processed through our client-facing AI agents (including, but not limited to, WhatsApp-based appointment systems), our online education platform Pausa y Aprende Sobre IA, and our direct communications with website visitors and prospective clients.
Cruce performs two distinct roles with respect to personal information:
Where Cruce acts as a processor, the data controller's privacy notice prevails for the processing they direct.
The specific personal information we process varies depending on the service, the client deployment, and our role as processor or controller. Across our products, the general categories of personal information we may collect or process include:
The specific categories of personal information processed in any particular client deployment are determined by the client (acting as data controller) and are disclosed in the client's own privacy notice. Cruce processes such data only as instructed by the client and as set forth in the executed service agreement and data processing addendum.
Regardless of deployment, Cruce does not collect or store financial account information (credit card numbers, bank details), Social Security numbers or government identification numbers, health or medical records, driver's license numbers, biometric identifiers, or precise geolocation data, except where expressly required by a specific client engagement and governed by a separate written agreement that establishes the additional safeguards and compliance obligations applicable to such categories.
For online course payments on our education platform Pausa y Aprende Sobre IA, payments are processed directly by our third-party payment provider Stripe, Inc., which is PCI-DSS Level 1 certified (see Sections 7 and 8). Cruce receives only payment confirmation data (such as a transaction reference, amount, and status) and does not store full credit card numbers, CVV codes, or bank account details.
Our services are not directed at children under the age of 13, and we do not knowingly collect personal information directly from children. When a parent or legal guardian provides a minor's name for the limited purpose of scheduling a service (such as a government or medical appointment), that information is collected from the responsible adult, not from the minor.
For California residents: in accordance with the California Consumer Privacy Act (CCPA/CPRA), we do not sell or share the personal information of consumers under the age of 16. We do not engage in the sale or sharing of personal information of any age group.
If you believe that personal information about a child has been submitted to us without proper parental consent, please contact us at the address in Section 19 and we will delete the information promptly.
We use personal information for the specific, limited purposes for which it was collected:
We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising. We do not use personal information for advertising purposes.
To operate our products and services, we rely on the following categories of third-party providers, each of whom processes personal information only as our subprocessor and under contractual data protection obligations:
Each provider is bound by its own contractual terms and privacy practices. We select providers that maintain recognized security certifications (such as SOC 2 Type II, PCI-DSS, ISO 27001, or equivalent) and that offer contractual data processing terms.
Pausa y Aprende Sobre IA is our online education platform offering courses, workshops, and digital learning materials about artificial intelligence. For this platform, Cruce acts as the data controller.
We collect from students: name, email address, account credentials, course enrollment and progress, payment confirmation data (course payments are processed by Stripe, Inc.; Cruce does not store full payment card numbers, CVV codes, or bank account details — see Section 7), and any messages or assignments submitted as part of coursework.
We use this information to provide the course experience, issue certificates, communicate updates about courses you are enrolled in, and improve our educational content. We do not use student data for unrelated marketing without your separate opt-in consent.
We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction, including:
No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect personal information, we cannot guarantee absolute security.
We retain personal information only for as long as necessary to fulfill the purposes described in this policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Default retention periods are:
When personal information is no longer needed, we either securely delete or irreversibly anonymize it.
Our websites use a limited set of cookies and similar technologies:
We do not use advertising cookies or third-party tracking pixels for behavioral advertising. You can configure your browser to refuse cookies; doing so may affect certain site features.
Subject to applicable law, you may have the right to:
Where our client is the data controller, we will direct your request to them or assist them in fulfilling it, as required by our service agreement. To exercise rights directly with Cruce, contact us using the details in Section 19. We will respond within the timeframes required by applicable law (typically 45 days under CCPA/CPRA, with one permitted extension).
This section provides additional information for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
Categories of personal information collected in the last twelve (12) months: identifiers (name, email, phone), commercial information (services scheduled or enrolled), internet activity (limited website usage), and inferences drawn from the above for service operation only.
Purposes: as described in Section 6.
Sale or sharing: we do not sell or share personal information as defined under the CCPA/CPRA, and have not done so in the preceding twelve months.
Sensitive personal information: we do not use or disclose sensitive personal information for purposes beyond those permitted by Section 7027(m) of the CCPA regulations.
California residents may exercise their rights by contacting us at the address in Section 19. We will not discriminate against any consumer for exercising their rights.
Some of our services involve processing personal information of individuals located outside the United States, including in Mexico. Where our client (data controller) is located in Mexico or processes Mexican residents' data, processing is governed primarily by the controller's own privacy notice under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.
For individuals who interact with Cruce directly (for example, students of Pausa y Aprende Sobre IA residing in Mexico), our corresponding Aviso de Privacidad Integral in Spanish, drafted in compliance with the LFPDPPP, is available on request and on our website's Spanish-language pages.
When you communicate with us through WhatsApp, your messages are subject to WhatsApp's own privacy policy and the terms of WhatsApp's Business API in addition to this policy. We receive and process message content through Meta's WhatsApp Business API by way of our messaging service provider (Twilio).
Message content is retained for the time necessary to fulfill the requested service (scheduling, confirmation, follow-up, and operational reporting to the client), and in any event no longer than the retention period specified in Section 10 or in the relevant client service agreement.
In the event of a personal data breach that creates a risk to affected individuals, we will:
Where Cruce processes personal information on behalf of a client, the specific terms of data handling, retention, security, confidentiality, and use are governed by the executed service agreement, data processing addendum, and non-disclosure agreement between Cruce and that client. In the event of any conflict between this policy and those client agreements with respect to data processed on behalf of that client, the client agreements prevail. This policy is intended to describe our general practices and to inform data subjects of their rights.
We may update this policy periodically to reflect changes in our practices, legal requirements, or business operations. The "Effective" date and "Version" at the top of this document indicate the most recent revision. Where changes are material, we will provide reasonable advance notice through our website or, where appropriate, by direct notification. Continued use of our services after the effective date of any changes constitutes acceptance of the updated policy.
For privacy-related inquiries, to exercise your rights, or to report a concern, please contact:
Cruce Consulting LLC
Privacy Office
Email: privacy@cruceconsulting.com
Website: cruceconsulting.com
Jurisdiction: Los Angeles County, California, United States
For Spanish-language inquiries or LFPDPPP-related rights in Mexico, please write to privacy@cruceconsulting.com and consult our Spanish-language Aviso de Privacidad Integral.